Security research, vulnerability analysis, and platform updates from the Exploit Intelligence Platform team. Deep dives into exploit trends, CVE intelligence, and the tools we build for the security community.
A TOCTOU race in VMware Fusion 25's vmx-apple binary that turns booting a VM into arbitrary chown, then arbitrary chown into a passwordless root shell via PAM injection. World-writable sticky directory, SUID-root callee, bind() and chown() both following symlinks, a 5-15 microsecond window between them. Full LPE chain in 40 seconds, single VM boot. The interesting part is what made it reliable.
Hermes Agent with the EIP Harness: a conversational AI vulnerability research assistant that runs full CVE pipelines while you stay in the loop. Built on Nous Research's Hermes. Showcase: a GitLab runner-token leak chained to RCE (CVE-2022-0735), a neatvnc pre-auth stack overflow (CVE-2026-42859), and a KEV-listed Everest Forms PHP Object Injection (CVE-2026-3296), all end to end. Our first public release of EIP CVE pipeline craft, plus win11-forge for Windows kernel and usermode lab orchestration.
read more
CVE-2026-41940: a CRLF session-injection in cPanel & WHM that turns six unauthenticated HTTP requests into root SSH. Source-level walkthrough and audit.
read more
EIP now exports CVE and exploit context as STIX 2.1 and serves a native TAXII 2.1 feed for SIEMs, TIPs, OpenCTI, Splunk ES, and Python pipelines.
read more
CVE-2026-35414 is a certificate principal matching bypass in OpenSSH before 10.3. The advisory says one bug. We found three - a comma-splitting misuse, an empty-principals wildcard, and a reversed match_pattern call - all hiding in the same commit. Two are independently exploitable for authentication bypass. We built working PoCs for both, then kept reading and found two more undocumented issues: a PermitListen bypass via Unix socket forwarding and a KRL revocation gap for serial-zero certificates.
read more
Line 781 says $query_to_run is safe. It isn't. An autonomous pipeline found a CVSS 9.8 unauthenticated SQL injection in WP Google Map Plugin v4.9.1 -- a three-link chain of individually harmless components that, together, give any visitor full database access. Then we kept reading and found the plugin deserializes update-check responses from an external server with maybe_unserialize(). 200,000+ active installs. 35 minutes. $8.97.
read more